CVE-2026-120578

AI Alt Text Generator lacks per-image editing authorization

migkapa · WordPress AI Alt Text Generator

First documented disclosure · Review checkpoint

Summary

A low-privilege user can trigger AI-generated metadata changes to someone else’s images.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 3.1. Severity source.

Exploitation not established: Malicious exploitation is not established by the reviewed primary sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The generation handler checked a nonce but omitted the attachment editing permission; a logged-out handler was also registered.

Conditions required

A Contributor-level account is needed to obtain the nonce. Changing titles, captions or descriptions additionally requires the matching plugin options.

Potential impact

Unauthorized replacement of attachment alt text and optionally other metadata. The source does not establish arbitrary attacker-selected prose, data theft or code execution.

Affected versions and configurations

Through 2.7.0.

Fix and mitigation status

2.7.1; official package comparison verifies per-image permissions and removal of the logged-out handler.

Practical next steps

Update to 2.7.1 or a later release containing the fix. Until then, disable the plugin on sites where untrusted authors can sign in; disabling metadata mirroring alone does not protect alt text.

Operating lesson

A nonce does not grant permission to modify the referenced object.

Evidence and limits

The official 2.7.1 security changelog carries SVN revision 3767321 dated October 26; the CNA timeline says disclosed October 27 and CVE publication followed November 3. Despite the CNA’s unauthenticated label, its description requires a Contributor-derived nonce. Wordfence’s page returned no body; the full CNA and official packages were reviewed.

Sources